Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Proxy: custom error pages #4174

Closed
AdSchellevis opened this issue Jun 17, 2020 · 6 comments
Closed

Proxy: custom error pages #4174

AdSchellevis opened this issue Jun 17, 2020 · 6 comments
Assignees
@AdSchellevis
Labels
feature Adding new functionality
Milestone
20.7

Comments

@AdSchellevis
Copy link
Member

Our proxy error pages use the squid defaults at the moment, since people want to be able to customise these pages, this FR should allow an option to store custom pages in the configuration.

As suggested in #828, a similar option as the Captive portal would be provided to upload/download pages the user can change and upload.

Relevant configuration section:

core/src/opnsense/service/templates/OPNsense/Proxy/squid.conf

Line 455 in ae39e9b

error_directory /usr/local/etc/squid/errors/{{ system.language|lower|replace("_","-")}}

Sponsored by Incenter Technology (https://www.incenter.tech/)
@AdSchellevis AdSchellevis added the feature Adding new functionality label Jun 17, 2020
@AdSchellevis AdSchellevis self-assigned this Jun 17, 2020
AdSchellevis added a commit that referenced this issue Jun 18, 2020
@AdSchellevis
Proxy: wireframe for #4174
b4212f7 
o cleanup default (English) error templates, rename to .html for easier editting. move css to include, which should be imported inline using our scripts.
o add frontend code
o extend model with template option.
AdSchellevis added a commit that referenced this issue Jun 19, 2020
@AdSchellevis
Proxy: work in progress #4174
d7abe75 
o move templates to src/opnsense/data/proxy, avoid lint issues
o initial version of install script (overlay and embed css)
o change squid.conf output, when error_page is provided use error_directory /usr/local/etc/squid/errors/local directory (install location)
o flush template data to error_directory.in (json) which is used as override

overlay logic needs some work to be able to use something similar on download. install hook should be called before squid startup to ensure proper error_pages.
AdSchellevis added a commit that referenced this issue Jun 20, 2020
@AdSchellevis
proxy: custom error pages. for #4174
53460ce 
o change ProxyTemplates() class and move overlay functionality to callers (so we can reuse the same class to download the templates later)
o rename install_template.py to deploy_error_pages.py and use overlay_enabled() method to figure out if "custom" or "opnsense" is selected
o add a configd action to deploy the error pages, for future use.
o hook deploy_error_pages.py in start/stop/restart/reconfigure actions
AdSchellevis added a commit that referenced this issue Jun 22, 2020
@AdSchellevis
Proxy: custom error pages (#4174)
f32e4b2 
o add template download configd call
o align controller and ui to use the download call (flush config to disk, request "active" error_pages)
o refactor deploy_error_pages.py to ease download_error_pages.py implementation
@AdSchellevis
Copy link
Member Author

to install on OPNsense 20.1.7 :

opnsense-patch  b4212f7 d7abe75 53460ce 
mv /usr/local/opnsense/scripts/proxy/install_template.py  /usr/local/opnsense/scripts/proxy/deploy_error_pages.py
mkdir -p /usr/local/opnsense/data/proxy
mv /usr/local/opnsense/scripts/proxy/template_error_pages /usr/local/opnsense/data/proxy/
opnsense-patch f32e4b2  

service configd restart

@fichtner fichtner added this to the 20.7 milestone Jun 23, 2020
@AndyX90
Copy link
Contributor

AndyX90 commented Aug 12, 2020

@AdSchellevis Would it be possible to include the C-ICAP - MALWARE FOUND - Page?

@AdSchellevis
Copy link
Member Author

@AndyX90 probably not, because it's not part of the squid errors (if I'm not mistaken c-icap hosts its files somewhere else as well). If there is a feedback possible to return icap errors into squid's normal stack, it might be suitable, but I don't think there is.

@AndyX90
Copy link
Contributor

AndyX90 commented Aug 12, 2020

@AdSchellevis Okay, my approach was that the Squid-Proxy-Template engine could be extended to nearly the whole system, including some plugin-themings as well. Like custom nginx pages (https://github.com/opnsense/plugins/tree/master/www/nginx/src/etc/nginx/views), icap (https://github.com/opnsense/plugins/tree/master/www/c-icap/src/opnsense/service/templates/OPNsense/CICAP) and maybe others. So that you can present a nearly uniform design to the users.

@AdSchellevis
Copy link
Member Author

@AndyX90 I can see why that looks attractive, but these components don't have a real relation with each other, which would taint the separation of concerns.

This often leads to either illogical spots from the user to change things (Nginx has no relation with proxy) or vague issues since services get glued together (restart squid, c-icap doesn't know).

We have spend years to remove most of these constructions from our code base, which is why we are very cautious bringing these back in. (For this to function properly would mean there would be some kind of contract between services to use this functionality, which isn't on our wish list at the moment).

@AndyX90
Copy link
Contributor

AndyX90 commented Aug 12, 2020

@AdSchellevis Okay, i understand. Thank you anyway!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@AdSchellevis AdSchellevis

Labels
feature Adding new functionality
Milestone
20.7
Development

No branches or pull requests
3 participants
@fichtner @AdSchellevis @AndyX90